1import { o as object, s as string, _ as _enum, l as linkPropSchema, d as imagePropSchema, e as any, f as array, g as colorPropSchema, h as boolean, u as useRenderContextOptional, j as jsxRuntimeExports } from "./index.mjs"; 2import "react"; 3object({ 4 platform: _enum([ 5 "facebook", 6 "instagram", 7 "twitter", 8 "linkedin", 9 "youtube", 10 "tiktok", 11 "pinterest" 12 ]), 13 url: string() 14}); 15object({ 16 label: string(), 17 link: linkPropSchema 18}); 19object({ 20 title: string(), 21 description: string() 22}); 23object({ 24 image: imagePropSchema.optional(), 25 altText: string().optional() 26}).passthrough(); 27object({ 28 beforeImage: imagePropSchema.optional(), 29 afterImage: imagePropSchema.optional() 30}); 31object({ 32 name: string(), 33 quote: string(), 34 role: string().optional(), 35 avatar: imagePropSchema.optional() 36}); 37object({ 38 name: string(), 39 title: string().optional(), 40 image: imagePropSchema.optional(), 41 description: string().optional() 42}); 43object({ 44 icon: string().optional(), 45 title: string(), 46 description: string().optional(), 47 image: imagePropSchema.optional() 48}); 49object({ 50 videoUrl: string(), 51 name: string().optional(), 52 quote: string().optional(), 53 thumbnailImage: imagePropSchema.optional() 54}); 55object({ 56 headlineLineOne: string().optional(), 57 headlineLineTwo: string().optional(), 58 // Coach's configured headline alignment (`base.customisation.headlines 59 // .textAlign`, e.g. 'left' | 'center' | 'right'). Drives the flex 60 // `justify-content` of the headline wrapper in `LegacyHeadline`. 61 headlineAlign: string().optional(), 62 // Per-line font sizes (e.g. "2.5em"). Unset = the baked `:root` size vars 63 // from the coach's migrated config, so pre-existing widget data renders 64 // exactly as before. Applied by `LegacyHeadline` as scoped CSS-var 65 // overrides covering both the hero (`--hero-line*-text*Size`) and body 66 // (`--body-headline-*-fontsize-*`) var families. 67 headlineLineOneSize: string().optional(), 68 headlineLineTwoSize: string().optional(), 69 headlineLineOneMobileSize: string().optional(), 70 headlineLineTwoMobileSize: string().optional(), 71 // Typography props (color/text-align/font-size/text-transform and their 72 // mobile variants) are accepted as opaque blobs so old widget data that 73 // stored the inspector's `{propType, align: ...}` wrapper doesn't fail 74 // schema validation. Legacy widget shells don't render against these 75 // values â typography comes from the lifted `:root` CSS vars. 76 headingColor: any().optional(), 77 headingTextAlign: any().optional(), 78 headingFontSize: any().optional(), 79 headingTextTransform: any().optional(), 80 mobileHeadingFontSize: any().optional(), 81 mobileHeadingTextAlign: any().optional(), 82 mobileHeadingColor: any().optional() 83}); 84object({ 85 mode: _enum(["none", "lead-form", "direct-purchase", "cta"]).default("lead-form"), 86 leadForm: object({ 87 /** 88 * @deprecated Replaced by the `none` mode. No longer written or exposed 89 * in the inspector, but retained so heroes a coach hid via the old "Show 90 * Lead Form" toggle (stored `enabled: false` with `mode: 'lead-form'`) 91 * keep rendering nothing â the render still honors an explicit `false` 92 * (see `LegacyLeadFormEmbedScript`). 93 */ 94 enabled: boolean().optional(), 95 /** 96 * Selected lead form (WebForm id). Empty â the coach's default form. 97 * The actual, environment-specific URL is resolved at render time from 98 * `RenderContext.leadForms`; `scriptUrl` is only a legacy fallback for 99 * pages migrated before backend resolution existed. 100 */ 101 formId: string().optional(), 102 scriptUrl: string().default(""), 103 // Heading/subtitle colors of the EMBEDDED form (the remote embed colors 104 // them from its own form theme, which a dark hero background can render 105 // illegible â see `legacyLeadFormColors`). Unset â the form theme's 106 // color stands. 107 titleColor: colorPropSchema.optional(), 108 subtitleColor: colorPropSchema.optional() 109 }).optional(), 110 cta: object({ 111 text: string().default("Get Started"), 112 url: string().default(""), 113 backgroundColor: colorPropSchema.optional(), 114 textColor: colorPropSchema.optional() 115 }).optional(), 116 directPurchase: object({ 117 items: array(object({ url: string().default("") })).default([]) 118 }).optional() 119}); 120const DIRECT_PURCHASE_IFRAME_HEIGHT = 292; 121function isEmbeddableUrl(url) { 122 try { 123 const { protocol }
123 = new URL(url); 124 return protocol === "https:" || protocol === "http:"; 125 } catch { 126 return false; 127 } 128} 129function DirectPurchaseEmbed({ 130 urls, 131 instanceId 132}) { 133 const ctx = useRenderContextOptional(); 134 const validUrls = (urls ?? []).map((url) => url?.trim() || "").filter(isEmbeddableUrl); 135 if (validUrls.length === 0) { 136 if (ctx?.mode === "editor") { 137 return /* @__PURE__ */ jsxRuntimeExports.jsx( 138 "div", 139 { 140 style: { 141 textAlign: "center", 142 padding: "2rem", 143 opacity: 0.5, 144 fontStyle: "italic" 145 }, 146 children: "Add a checkout URL to embed your product" 147 } 148 ); 149 } 150 return null; 151 } 152 return /* @__PURE__ */ jsxRuntimeExports.jsx( 153 "div", 154 { 155 style: { 156 display: "flex", 157 flexWrap: "wrap", 158 justifyContent: "center", 159 gap: "1em", 160 marginTop: "1.5rem" 161 }, 162 children: validUrls.map((url, index) => /* @__PURE__ */ jsxRuntimeExports.jsx( 163 "div", 164 { 165 style: { 166 backgroundColor: "#ffffff", 167 borderRadius: "var(--border-radius-size, 12px)", 168 overflow: "hidden", 169 // Lift above absolutely-positioned section overlays (e.g. the 170 // legacy `.hero-overlay`) that otherwise swallow clicks on the 171 // cross-origin checkout iframe. 172 position: "relative", 173 zIndex: 1 174 }, 175 children: /* @__PURE__ */ jsxRuntimeExports.jsx( 176 "iframe", 177 { 178 title: `Direct purchase ${instanceId ? `${instanceId} ` : ""}${index + 1}`, 179 src: url, 180 loading: "lazy", 181 scrolling: "no", 182 style: { 183 border: 0, 184 display: "block", 185 height: `${DIRECT_PURCHASE_IFRAME_HEIGHT}px` 186 } 187 } 188 ) 189 }, 190 `${url}-${index}` 191 )) 192 } 193 ); 194} 195/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */ 196function _arrayLikeToArray(r, a) { 197 (null == a || a > r.length) && (a = r.length); 198 for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; 199 return n; 200} 201function _arrayWithHoles(r) { 202 if (Array.isArray(r)) return r; 203} 204function _iterableToArrayLimit(r, l) { 205 var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; 206 if (null != t) { 207 var e, n, i, u, a = [], f = true, o = false; 208 try { 209 if (i = (t = t.call(r)).next, 0 === l) ; 210 else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = true) ; 211 } catch (r2) { 212 o = true, n = r2; 213 } finally { 214 try { 215 if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return; 216 } finally { 217 if (o) throw n; 218 } 219 } 220 return a; 221 } 222} 223function _nonIterableRest() { 224 throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); 225} 226function _slicedToArray(r, e) { 227 return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest(); 228} 229function _unsupportedIterableToArray(r, a) { 230 if (r) { 231 if ("string" == typeof r) return _arrayLikeToArray(r, a); 232 var t = {}.toString.call(r).slice(8, -1); 233 return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; 234 } 235} 236const entries = Object.entries, setPrototypeOf = Object.setPrototypeOf, isFrozen = Object.isFrozen, getPrototypeOf = Object.getPrototypeOf, getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor; 237let freeze = Object.freeze, seal = Object.seal, create = Object.create; 238let _ref = typeof Reflect !== "undefined" && Reflect, apply = _ref.apply, construct = _ref.construct; 239if (!freeze) { 240 freeze = function freeze2(x) { 241 return x; 242 }; 243} 244if (!seal) { 245 seal = function seal2(x) { 246 return x; 247 }; 248} 249if (!apply) { 250 apply = function apply2(func, thisArg) { 251 for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) { 252 args[_key - 2] = arguments[_key]; 253 } 254 return func.apply(thisArg, args); 255 }; 256} 257if (!construct) { 258 construct = function construct2(Func) { 259 for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) { 260 args[_key2 - 1] = arguments[_key2]; 261 } 262 return new Func(...args); 263 }; 264} 265const arrayForEach = unapply(Array.prototype.forEach); 266const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf); 267const arrayPop = unapply(Array.prototype.pop); 268const arrayPush = unapply(Array.prototype.push); 269const arraySplice = unapply(Array.prototype.splice); 270const arrayIsArray = Array.isArray; 271const stringToLowerCase = unapply(String.prototype.toLowerCase); 272const stringToString = unapply(String.prototype.toString); 273const stringMatch = unapply(String.prototype.match); 274const stringReplace = unapply(String.prototype.replace); 275const stringIndexOf = unapply(String.prototype.indexOf); 276const stringTrim = unapply(String.prototype.trim); 277const numberToString = unapply(Number.prototype.toString); 278const booleanToString = unapply(Boolean.prototype.toString); 279const bigintToString = typeof BigInt === "undefined" ? null : unapply(BigInt.prototype.toString); 280const symbolToString = typeof Symbol === "undefined" ? null : unapply(Symbol.prototype.toString); 281const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty); 282const objectToString = unapply(Object.prototype.toString); 283const regExpTest = unapply(RegExp.prototype.test); 284const typeErrorCreate = unconstruct(TypeError); 285function unapply(func) { 286 return function(thisArg) { 287 if (thisArg instanceof RegExp) { 288 thisArg.lastIndex = 0; 289 } 290 for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) { 291 args[_key3 - 1] = arguments[_key3]; 292 } 293 return apply(func, thisArg, args); 294 }; 295} 296function unconstruct(Func) { 297 return function() { 298 for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
vendor: 7,699 bytes, lines 299-428
299 args[_key4] = arguments[_key4]; 300 } 301 return construct(Func, args); 302 }; 303} 304function addToSet(set, array2) { 305 let transformCaseFunc = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : stringToLowerCase; 306 if (setPrototypeOf) { 307 setPrototypeOf(set, null); 308 } 309 if (!arrayIsArray(array2)) { 310 return set; 311 } 312 let l = array2.length; 313 while (l--) { 314 let element = array2[l]; 315 if (typeof element === "string") { 316 const lcElement = transformCaseFunc(element); 317 if (lcElement !== element) { 318 if (!isFrozen(array2)) { 319 array2[l] = lcElement; 320 } 321 element = lcElement; 322 } 323 } 324 set[element] = true; 325 } 326 return set; 327} 328function cleanArray(array2) { 329 for (let index = 0; index < array2.length; index++) { 330 const isPropertyExist = objectHasOwnProperty(array2, index); 331 if (!isPropertyExist) { 332 array2[index] = null; 333 } 334 } 335 return array2; 336} 337function clone(object2) { 338 const newObject = create(null); 339 for (const _ref2 of entries(object2)) { 340 var _ref3 = _slicedToArray(_ref2, 2); 341 const property = _ref3[0]; 342 const value = _ref3[1]; 343 const isPropertyExist = objectHasOwnProperty(object2, property); 344 if (isPropertyExist) { 345 if (arrayIsArray(value)) { 346 newObject[property] = cleanArray(value); 347 } else if (value && typeof value === "object" && value.constructor === Object) { 348 newObject[property] = clone(value); 349 } else { 350 newObject[property] = value; 351 } 352 } 353 } 354 return newObject; 355} 356function stringifyValue(value) { 357 switch (typeof value) { 358 case "string": { 359 return value; 360 } 361 case "number": { 362 return numberToString(value); 363 } 364 case "boolean": { 365 return booleanToString(value); 366 } 367 case "bigint": { 368 return bigintToString ? bigintToString(value) : "0"; 369 } 370 case "symbol": { 371 return symbolToString ? symbolToString(value) : "Symbol()"; 372 } 373 case "undefined": { 374 return objectToString(value); 375 } 376 case "function": 377 case "object": { 378 if (value === null) { 379 return objectToString(value); 380 } 381 const valueAsRecord = value; 382 const valueToString = lookupGetter(valueAsRecord, "toString"); 383 if (typeof valueToString === "function") { 384 const stringified = valueToString(valueAsRecord); 385 return typeof stringified === "string" ? stringified : objectToString(stringified); 386 } 387 return objectToString(value); 388 } 389 default: { 390 return objectToString(value); 391 } 392 } 393} 394function lookupGetter(object2, prop) { 395 while (object2 !== null) { 396 const desc = getOwnPropertyDescriptor(object2, prop); 397 if (desc) { 398 if (desc.get) { 399 return unapply(desc.get); 400 } 401 if (typeof desc.value === "function") { 402 return unapply(desc.value); 403 } 404 } 405 object2 = getPrototypeOf(object2); 406 } 407 function fallbackValue() { 408 return null; 409 } 410 return fallbackValue; 411} 412function isRegex(value) { 413 try { 414 regExpTest(value, ""); 415 return true; 416 } catch (_unused) { 417 return false; 418 } 419} 420const html$1 = freeze(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "search", "section", "select", "shadow", "slot", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]); 421const svg$1 = freeze(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "enterkeyhint", "exportparts", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "inputmode", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "part", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]); 422const svgFilters = freeze(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]); 423const svgDisallowed = freeze(["animate", "color-profile", "cursor", "discard", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]); 424const mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]); 425const mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]); 426const text = freeze(["#text"]); 427const html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "command", "commandfor", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns"]); 428const svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "dis
428play", "divisor", "dominant-baseline", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "pointer-events", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-orientation", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "vector-effect", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]); 429const mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnalign", "columnlines", "columnspacing", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lquote", "lspace", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]); 430const xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]); 431const MUSTACHE_EXPR = seal(/{{[\w\W]*|^[\w\W]*}}/g); 432const ERB_EXPR = seal(/<%[\w\W]*|^[\w\W]*%>/g); 433const TMPLIT_EXPR = seal(/\${[\w\W]*/g); 434const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); 435const ARIA_ATTR = seal(/^aria-[\-\w]+$/); 436const IS_ALLOWED_URI = seal( 437 /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i 438 // eslint-disable-line no-useless-escape 439); 440const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i); 441const ATTR_WHITESPACE = seal( 442 /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g 443 // eslint-disable-line no-control-regex 444); 445const DOCTYPE_NAME = seal(/^html$/i); 446const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i); 447const ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g); 448const COMMENT_MARKUP_PROBE = seal(/<[/\w]/g); 449const FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i); 450const SELF_CLOSING_TAG = seal(/\/>/i); 451const NODE_TYPE = { 452 element: 1, 453 attribute: 2, 454 text: 3, 455 cdataSection: 4, 456 entityReference: 5, 457 // Deprecated 458 entityNode: 6, 459 // Deprecated 460 processingInstruction: 7, 461 comment: 8, 462 document: 9, 463 documentType: 10, 464 documentFragment: 11, 465 notation: 12 466 // Deprecated 467}; 468const LITERAL_TEXT_ELEMENT_NAMES = ["style", "script", "xmp", "iframe", "noembed", "noframes", "plaintext", "noscript"]; 469const LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, LITERAL_TEXT_ELEMENT_NAMES)); 470const LITERAL_TEXT_CLOSE = function() { 471 const map = {}; 472 arrayForEach(LITERAL_TEXT_ELEMENT_NAMES, (name) => { 473 map[name] = seal(new RegExp("</" + name + "(?=[\\t\\n\\f\\r />])", "i")); 474 }); 475 return freeze(map); 476}(); 477const getGlobal = function getGlobal2() { 478 return typeof window === "undefined" ? null : window; 479}; 480const _createTrustedTypesPolicy = function _createTrustedTypesPolicy2(trustedTypes, purifyHostElement) { 481 if (typeof trustedTypes !== "object" || typeof trustedTypes.createPolicy !== "function") { 482 return null; 483 } 484 let suffix = null; 485 const ATTR_NAME = "data-tt-policy-suffix"; 486 if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) { 487 suffix = purifyHostElement.getAttribute(ATTR_NAME); 488 } 489 const policyName = "dompurify" + (suffix ? "#" + suffix : ""); 490 try { 491 return trustedTypes.createPolicy(policyName, { 492 createHTML(html2) { 493 return html2; 494 }, 495 createScriptURL(scriptUrl) { 496 return scriptUrl; 497 } 498 }); 499 } catch (_) { 500 console.warn("TrustedTypes policy " + policyName + " could not be created."); 501 return null; 502 } 503}; 504const _createHooksMap = function _createHooksMap2() { 505 return { 506 afterSanitizeAttributes: [], 507 afterSanitizeElements: [], 508 afterSanitizeShadowDOM: [], 509 beforeSanitizeAttributes: [], 510 beforeSanitizeElements: [], 511 beforeSanitizeShadowDOM: [], 512 uponSanitizeAttribute: [], 513 uponSanitizeElement: [], 514 uponSanitizeShadowNode: [] 515 }; 516}; 517const _resolveSetOption = function _resolveSetOption2(cfg, key, fallback, options) { 518 return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback; 519}; 520const _resolveObjectOption = function _resolveObjectOption2(cfg, key, makeFallback) { 521 const value = objectHasOwnProperty(cfg, key) ? cfg[key] : void 0; 522 return value && typeof value === "object" ? clone(value) : makeFallback(); 523}; 524function createDOMPurify() { 525 let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal(); 526 const DOMPurify = (root) => createDOMPurify(root); 527 DOMPurify.version = "3.4.14"; 528 DOMPurify.removed = []; 529 if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document || !window2.Element) { 530 DOMPurify.isSupported = false;
vendor: 3,366 bytes, lines 531-599
531 return DOMPurify; 532 } 533 let document = window2.document; 534 const originalDocument = document; 535 const currentScript = originalDocument.currentScript; 536 window2.DocumentFragment; 537 const HTMLTemplateElement = window2.HTMLTemplateElement, Node = window2.Node, Element = window2.Element, NodeFilter = window2.NodeFilter, _window$NamedNodeMap = window2.NamedNodeMap; 538 _window$NamedNodeMap === void 0 ? window2.NamedNodeMap || window2.MozNamedAttrMap : _window$NamedNodeMap; 539 window2.HTMLFormElement; 540 const DOMParser = window2.DOMParser, trustedTypes = window2.trustedTypes; 541 const ElementPrototype = Element.prototype; 542 const cloneNode = lookupGetter(ElementPrototype, "cloneNode"); 543 const remove = lookupGetter(ElementPrototype, "remove"); 544 const getNextSibling = lookupGetter(ElementPrototype, "nextSibling"); 545 const getChildNodes = lookupGetter(ElementPrototype, "childNodes"); 546 const getParentNode = lookupGetter(ElementPrototype, "parentNode"); 547 const getShadowRoot = lookupGetter(ElementPrototype, "shadowRoot"); 548 const getAttributes = lookupGetter(ElementPrototype, "attributes"); 549 const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeType") : null; 550 const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeName") : null; 551 const getOwnerDocument = Node && Node.prototype ? lookupGetter(Node.prototype, "ownerDocument") : null; 552 const _readNodeType = function _readNodeType2(node) { 553 return getNodeType ? getNodeType(node) : node.nodeType; 554 }; 555 const _readNodeName = function _readNodeName2(node) { 556 return getNodeName ? getNodeName(node) : node.nodeName; 557 }; 558 if (typeof HTMLTemplateElement === "function") { 559 const template = document.createElement("template"); 560 if (template.content && template.content.ownerDocument) { 561 document = template.content.ownerDocument; 562 } 563 } 564 let trustedTypesPolicy; 565 let emptyHTML = ""; 566 let defaultTrustedTypesPolicy; 567 let defaultTrustedTypesPolicyResolved = false; 568 let IN_TRUSTED_TYPES_POLICY = 0; 569 const _assertNotInTrustedTypesPolicy = function _assertNotInTrustedTypesPolicy2() { 570 if (IN_TRUSTED_TYPES_POLICY > 0) { 571 throw typeErrorCreate('A configured TRUSTED_TYPES_POLICY callback (createHTML or createScriptURL) must not call DOMPurify.sanitize, as that causes infinite recursion. Do not pass a policy whose callbacks wrap DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted Types" section of the README.'); 572 } 573 }; 574 const _createTrustedHTML = function _createTrustedHTML2(html2) { 575 _assertNotInTrustedTypesPolicy(); 576 IN_TRUSTED_TYPES_POLICY++; 577 try { 578 return trustedTypesPolicy.createHTML(html2); 579 } finally { 580 IN_TRUSTED_TYPES_POLICY--; 581 } 582 }; 583 const _createTrustedScriptURL = function _createTrustedScriptURL2(scriptUrl) { 584 _assertNotInTrustedTypesPolicy(); 585 IN_TRUSTED_TYPES_POLICY++; 586 try { 587 return trustedTypesPolicy.createScriptURL(scriptUrl); 588 } finally { 589 IN_TRUSTED_TYPES_POLICY--; 590 } 591 }; 592 const _getDefaultTrustedTypesPolicy = function _getDefaultTrustedTypesPolicy2() { 593 if (!defaultTrustedTypesPolicyResolved) { 594 defaultTrustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript); 595 defaultTrustedTypesPolicyResolved = true; 596 } 597 return defaultTrustedTypesPolicy; 598 }; 599 const _document = document
vendor: 4,978 bytes, lines 599-724
599, implementation = _document.implementation, createNodeIterator = _document.createNodeIterator, createDocumentFragment = _document.createDocumentFragment, getElementsByTagName = _document.getElementsByTagName; 600 const importNode = originalDocument.importNode; 601 let hooks = _createHooksMap(); 602 DOMPurify.isSupported = typeof entries === "function" && typeof getParentNode === "function" && implementation && implementation.createHTMLDocument !== void 0; 603 const MUSTACHE_EXPR$1 = MUSTACHE_EXPR, ERB_EXPR$1 = ERB_EXPR, TMPLIT_EXPR$1 = TMPLIT_EXPR, DATA_ATTR$1 = DATA_ATTR, ARIA_ATTR$1 = ARIA_ATTR, IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA, ATTR_WHITESPACE$1 = ATTR_WHITESPACE, CUSTOM_ELEMENT$1 = CUSTOM_ELEMENT; 604 let IS_ALLOWED_URI$1 = IS_ALLOWED_URI; 605 let ALLOWED_TAGS = null; 606 const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]); 607 let ALLOWED_ATTR = null; 608 const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]); 609 let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, { 610 tagNameCheck: { 611 writable: true, 612 configurable: false, 613 enumerable: true, 614 value: null 615 }, 616 attributeNameCheck: { 617 writable: true, 618 configurable: false, 619 enumerable: true, 620 value: null 621 }, 622 allowCustomizedBuiltInElements: { 623 writable: true, 624 configurable: false, 625 enumerable: true, 626 value: false 627 } 628 })); 629 let FORBID_TAGS = null; 630 let FORBID_ATTR = null; 631 const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, { 632 tagCheck: { 633 writable: true, 634 configurable: false, 635 enumerable: true, 636 value: null 637 }, 638 attributeCheck: { 639 writable: true, 640 configurable: false, 641 enumerable: true, 642 value: null 643 } 644 })); 645 let ALLOW_ARIA_ATTR = true; 646 let ALLOW_DATA_ATTR = true; 647 let ALLOW_UNKNOWN_PROTOCOLS = false; 648 let ALLOW_SELF_CLOSE_IN_ATTR = true; 649 let SAFE_FOR_TEMPLATES = false; 650 let SAFE_FOR_XML = true; 651 let WHOLE_DOCUMENT = false; 652 let SET_CONFIG = false; 653 let SET_CONFIG_ALLOWED_TAGS = null; 654 let SET_CONFIG_ALLOWED_ATTR = null; 655 let FORCE_BODY = false; 656 let RETURN_DOM = false; 657 let RETURN_DOM_FRAGMENT = false; 658 let RETURN_TRUSTED_TYPE = false; 659 let SANITIZE_DOM = true; 660 let SANITIZE_NAMED_PROPS = false; 661 const SANITIZE_NAMED_PROPS_PREFIX = "user-content-"; 662 let KEEP_CONTENT = true; 663 let IN_PLACE = false; 664 let USE_PROFILES = {}; 665 let FORBID_CONTENTS = null; 666 const DEFAULT_FORBID_CONTENTS = addToSet({}, [ 667 "annotation-xml", 668 "audio", 669 "colgroup", 670 "desc", 671 "foreignobject", 672 "head", 673 "iframe", 674 "math", 675 "mi", 676 "mn", 677 "mo", 678 "ms", 679 "mtext", 680 "noembed", 681 "noframes", 682 "noscript", 683 "plaintext", 684 "script", 685 // <selectedcontent> mirrors the selected <option>'s subtree, cloned by 686 // the UA (customizable <select>) â including any on* handlers â and the 687 // engine re-mirrors synchronously whenever a removal changes which 688 // option/selectedcontent is current, even inside DOMPurify's inert 689 // DOMParser document. Hoisting its children on removal re-inserts a fresh 690 // mirror target ahead of the walk, which the engine refills, looping 691 // forever (DoS) and amplifying output. Dropping its content on removal 692 // (rather than hoisting) breaks that cascade; the content is a duplicate 693 // of the option, which is sanitized on its own. See campaign-3 F1/F6. 694 "selectedcontent", 695 "style", 696 "svg", 697 "template", 698 "thead", 699 "title", 700 "video", 701 "xmp" 702 ]); 703 let DATA_URI_TAGS = null; 704 const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]); 705 let URI_SAFE_ATTRIBUTES = null; 706 const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]); 707 const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML"; 708 const SVG_NAMESPACE = "http://www.w3.org/2000/svg"; 709 const HTML_NAMESPACE = "http://www.w3.org/1999/xhtml"; 710 let NAMESPACE = HTML_NAMESPACE; 711 let IS_EMPTY_INPUT = false; 712 let ALLOWED_NAMESPACES = null; 713 const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString); 714 const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze(["mi", "mo", "mn", "ms", "mtext"]); 715 let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS); 716 const DEFAULT_HTML_INTEGRATION_POINTS = freeze(["annotation-xml"]); 717 let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS); 718 const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]); 719 let PARSER_MEDIA_TYPE = null; 720 const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"]; 721 const DEFAULT_PARSER_MEDIA_TYPE = "text/html"; 722 let transformCaseFunc = null; 723 let CONFIG = null; 724 const formElement = document
724.createElement("form"); 725 const isRegexOrFunction = function isRegexOrFunction2(testValue) { 726 return testValue instanceof RegExp || testValue instanceof Function; 727 }; 728 const _parseConfig = function _parseConfig2() {
vendor: 4,182 bytes, lines 729-809
729 let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {}; 730 if (CONFIG && CONFIG === cfg) { 731 return; 732 } 733 if (!cfg || typeof cfg !== "object") { 734 cfg = {}; 735 } 736 cfg = clone(cfg); 737 PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes 738 SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE; 739 transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase; 740 ALLOWED_TAGS = _resolveSetOption(cfg, "ALLOWED_TAGS", DEFAULT_ALLOWED_TAGS, { 741 transform: transformCaseFunc 742 }); 743 ALLOWED_ATTR = _resolveSetOption(cfg, "ALLOWED_ATTR", DEFAULT_ALLOWED_ATTR, { 744 transform: transformCaseFunc 745 }); 746 ALLOWED_NAMESPACES = _resolveSetOption(cfg, "ALLOWED_NAMESPACES", DEFAULT_ALLOWED_NAMESPACES, { 747 transform: stringToString 748 }); 749 URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, "ADD_URI_SAFE_ATTR", DEFAULT_URI_SAFE_ATTRIBUTES, { 750 transform: transformCaseFunc, 751 base: DEFAULT_URI_SAFE_ATTRIBUTES 752 }); 753 DATA_URI_TAGS = _resolveSetOption(cfg, "ADD_DATA_URI_TAGS", DEFAULT_DATA_URI_TAGS, { 754 transform: transformCaseFunc, 755 base: DEFAULT_DATA_URI_TAGS 756 }); 757 FORBID_CONTENTS = _resolveSetOption(cfg, "FORBID_CONTENTS", DEFAULT_FORBID_CONTENTS, { 758 transform: transformCaseFunc 759 }); 760 FORBID_TAGS = _resolveSetOption(cfg, "FORBID_TAGS", clone({}), { 761 transform: transformCaseFunc 762 }); 763 FORBID_ATTR = _resolveSetOption(cfg, "FORBID_ATTR", clone({}), { 764 transform: transformCaseFunc 765 }); 766 USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === "object" ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false; 767 ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; 768 ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; 769 ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; 770 ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; 771 SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; 772 SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; 773 WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; 774 RETURN_DOM = cfg.RETURN_DOM || false; 775 RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; 776 RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; 777 FORCE_BODY = cfg.FORCE_BODY || false; 778 SANITIZE_DOM = cfg.SANITIZE_DOM !== false; 779 SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; 780 KEEP_CONTENT = cfg.KEEP_CONTENT !== false; 781 IN_PLACE = cfg.IN_PLACE || false; 782 IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI; 783 NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE; 784 MATHML_TEXT_INTEGRATION_POINTS = _resolveObjectOption( 785 cfg, 786 "MATHML_TEXT_INTEGRATION_POINTS", 787 () => addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS) 788 // Default built-in map 789 ); 790 HTML_INTEGRATION_POINTS = _resolveObjectOption( 791 cfg, 792 "HTML_INTEGRATION_POINTS", 793 () => addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS) 794 // Default built-in map 795 ); 796 const customElementHandling = _resolveObjectOption(cfg, "CUSTOM_ELEMENT_HANDLING", () => create(null)); 797 CUSTOM_ELEMENT_HANDLING = create(null); 798 if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) { 799 CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck; 800 } 801 if (objectHasOwnProperty(customElementHandling, "attributeNameCheck") && isRegexOrFunction(customElementHandling.attributeNameCheck)) { 802 CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck; 803 } 804 if (objectHasOwnProperty(customElementHandling, "allowCustomizedBuiltInElements") && typeof customElementHandling.allowCustomizedBuiltInElements === "boolean") { 805 CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements; 806 } 807 seal(CUSTOM_ELEMENT_HANDLING); 808 if (SAFE_FOR_TEMPLATES) { 809 ALLOW_DATA_ATTR = false;
vendor: 4,506 bytes, lines 810-928
810 } 811 if (RETURN_DOM_FRAGMENT) { 812 RETURN_DOM = true; 813 } 814 if (USE_PROFILES) { 815 ALLOWED_TAGS = addToSet({}, text); 816 ALLOWED_ATTR = create(null); 817 if (USE_PROFILES.html === true) { 818 addToSet(ALLOWED_TAGS, html$1); 819 addToSet(ALLOWED_ATTR, html); 820 } 821 if (USE_PROFILES.svg === true) { 822 addToSet(ALLOWED_TAGS, svg$1); 823 addToSet(ALLOWED_ATTR, svg); 824 addToSet(ALLOWED_ATTR, xml); 825 } 826 if (USE_PROFILES.svgFilters === true) { 827 addToSet(ALLOWED_TAGS, svgFilters); 828 addToSet(ALLOWED_ATTR, svg); 829 addToSet(ALLOWED_ATTR, xml); 830 } 831 if (USE_PROFILES.mathMl === true) { 832 addToSet(ALLOWED_TAGS, mathMl$1); 833 addToSet(ALLOWED_ATTR, mathMl); 834 addToSet(ALLOWED_ATTR, xml); 835 } 836 } 837 EXTRA_ELEMENT_HANDLING.tagCheck = null; 838 EXTRA_ELEMENT_HANDLING.attributeCheck = null; 839 if (objectHasOwnProperty(cfg, "ADD_TAGS")) { 840 if (typeof cfg.ADD_TAGS === "function") { 841 EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS; 842 } else if (arrayIsArray(cfg.ADD_TAGS)) { 843 if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) { 844 ALLOWED_TAGS = clone(ALLOWED_TAGS); 845 } 846 addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc); 847 } 848 } 849 if (objectHasOwnProperty(cfg, "ADD_ATTR")) { 850 if (typeof cfg.ADD_ATTR === "function") { 851 EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR; 852 } else if (arrayIsArray(cfg.ADD_ATTR)) { 853 if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) { 854 ALLOWED_ATTR = clone(ALLOWED_ATTR); 855 } 856 addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc); 857 } 858 } 859 if (objectHasOwnProperty(cfg, "ADD_FORBID_CONTENTS") && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) { 860 if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) { 861 FORBID_CONTENTS = clone(FORBID_CONTENTS); 862 } 863 addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc); 864 } 865 if (KEEP_CONTENT) { 866 ALLOWED_TAGS["#text"] = true; 867 } 868 if (WHOLE_DOCUMENT) { 869 addToSet(ALLOWED_TAGS, ["html", "head", "body"]); 870 } 871 if (ALLOWED_TAGS.table) { 872 addToSet(ALLOWED_TAGS, ["tbody"]); 873 delete FORBID_TAGS.tbody; 874 } 875 if (cfg.TRUSTED_TYPES_POLICY) { 876 if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== "function") { 877 throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.'); 878 } 879 if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") { 880 throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.'); 881 } 882 const previousTrustedTypesPolicy = trustedTypesPolicy; 883 trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; 884 try { 885 emptyHTML = _createTrustedHTML(""); 886 } catch (error) { 887 trustedTypesPolicy = previousTrustedTypesPolicy; 888 throw error; 889 } 890 } else if (cfg.TRUSTED_TYPES_POLICY === null) { 891 trustedTypesPolicy = void 0; 892 emptyHTML = ""; 893 } else { 894 if (trustedTypesPolicy === void 0) { 895 trustedTypesPolicy = _getDefaultTrustedTypesPolicy(); 896 } 897 if (trustedTypesPolicy && typeof emptyHTML === "string") { 898 emptyHTML = _createTrustedHTML(""); 899 } 900 } 901 if (freeze) { 902 freeze(cfg); 903 } 904 CONFIG = cfg; 905 }; 906 const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]); 907 const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]); 908 const _checkSvgNamespace = function _checkSvgNamespace2(tagName, parent, parentTagName) { 909 if (parent.namespaceURI === HTML_NAMESPACE) { 910 return tagName === "svg"; 911 } 912 if (parent.namespaceURI === MATHML_NAMESPACE) { 913 return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]); 914 } 915 return Boolean(ALL_SVG_TAGS[tagName]); 916 }; 917 const _checkMathMlNamespace = function _checkMathMlNamespace2(tagName, parent, parentTagName) { 918 if (parent.namespaceURI === HTML_NAMESPACE) { 919 return tagName === "math"; 920 } 921 if (parent.namespaceURI === SVG_NAMESPACE) { 922 return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName]; 923 } 924 return Boolean(ALL_MATHML_TAGS[tagName]); 925 }; 926 const _checkHtmlNamespace = function _checkHtmlNamespace2(tagName, parent, parentTagName) { 927 if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) { 928 return false;
vendor: 29,710 bytes, lines 929-1716
929 } 930 if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) { 931 return false; 932 } 933 return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]); 934 }; 935 const _checkValidNamespace = function _checkValidNamespace2(element) { 936 let parent = getParentNode(element); 937 if (!parent || !parent.tagName) { 938 parent = { 939 namespaceURI: NAMESPACE, 940 tagName: "template" 941 }; 942 } 943 const tagName = stringToLowerCase(element.tagName); 944 const parentTagName = stringToLowerCase(parent.tagName); 945 if (!ALLOWED_NAMESPACES[element.namespaceURI]) { 946 return false; 947 } 948 if (element.namespaceURI === SVG_NAMESPACE) { 949 return _checkSvgNamespace(tagName, parent, parentTagName); 950 } 951 if (element.namespaceURI === MATHML_NAMESPACE) { 952 return _checkMathMlNamespace(tagName, parent, parentTagName); 953 } 954 if (element.namespaceURI === HTML_NAMESPACE) { 955 return _checkHtmlNamespace(tagName, parent, parentTagName); 956 } 957 if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) { 958 return true; 959 } 960 return false; 961 }; 962 const _forceRemove = function _forceRemove2(node) { 963 arrayPush(DOMPurify.removed, { 964 element: node 965 }); 966 try { 967 getParentNode(node).removeChild(node); 968 } catch (_) { 969 remove(node); 970 if (!getParentNode(node)) { 971 throw typeErrorCreate("a node selected for removal could not be detached from its tree and cannot be safely returned; refusing to sanitize in place"); 972 } 973 } 974 }; 975 const _stripAttributeNode = function _stripAttributeNode2(element, attribute, name) { 976 try { 977 element.removeAttributeNode(attribute); 978 } catch (_) { 979 try { 980 element.removeAttribute(name); 981 } catch (_2) { 982 } 983 } 984 }; 985 const _neutralizeRoot = function _neutralizeRoot2(root) { 986 _neutralizeSubtree(root); 987 const childNodes = getChildNodes(root); 988 if (childNodes) { 989 const snapshot = []; 990 arrayForEach(childNodes, (child) => { 991 arrayPush(snapshot, child); 992 }); 993 arrayForEach(snapshot, (child) => { 994 try { 995 remove(child); 996 } catch (_) { 997 } 998 }); 999 } 1000 const attributes = getAttributes(root); 1001 if (attributes) { 1002 for (let i = attributes.length - 1; i >= 0; --i) { 1003 const attribute = attributes[i]; 1004 const name = attribute && attribute.name; 1005 if (typeof name === "string") { 1006 _stripAttributeNode(root, attribute, name); 1007 } 1008 } 1009 } 1010 }; 1011 const _removeAttribute = function _removeAttribute2(name, element, attr) { 1012 if (!attr) { 1013 try { 1014 attr = element.getAttributeNode(name); 1015 } catch (_) { 1016 attr = null; 1017 } 1018 } 1019 arrayPush(DOMPurify.removed, { 1020 attribute: attr || null, 1021 from: element 1022 }); 1023 try { 1024 if (attr) { 1025 element.removeAttributeNode(attr); 1026 } else { 1027 element.removeAttribute(name); 1028 } 1029 } catch (_) { 1030 try { 1031 element.removeAttribute(name); 1032 } catch (_2) { 1033 } 1034 } 1035 if (name === "is") { 1036 if (RETURN_DOM || RETURN_DOM_FRAGMENT) { 1037 try { 1038 _forceRemove(element); 1039 } catch (_) { 1040 } 1041 } else { 1042 try { 1043 element.setAttribute(name, ""); 1044 } catch (_) { 1045 } 1046 } 1047 } 1048 }; 1049 const _stripDisallowedAttributes = function _stripDisallowedAttributes2(element) { 1050 const attributes = getAttributes(element); 1051 if (!attributes) { 1052 return; 1053 } 1054 for (let i = attributes.length - 1; i >= 0; --i) { 1055 const attribute = attributes[i]; 1056 const name = attribute && attribute.name; 1057 if (typeof name !== "string" || ALLOWED_ATTR[transformCaseFunc(name)]) { 1058 continue; 1059 } 1060 _stripAttributeNode(element, attribute, name); 1061 } 1062 }; 1063 const _neutralizeSubtree = function _neutralizeSubtree2(root) { 1064 const stack = [root]; 1065 while (stack.length > 0) { 1066 const node = stack.pop(); 1067 const nodeType = _readNodeType(node); 1068 if (nodeType === NODE_TYPE.element) { 1069 _stripDisallowedAttributes(node); 1070 } 1071 const childNodes = getChildNodes(node); 1072 if (childNodes) { 1073 for (let i = childNodes.length - 1; i >= 0; --i) { 1074 stack.push(childNodes[i]); 1075 } 1076 } 1077 } 1078 }; 1079 const _isPatchLinkageAttribute = function _isPatchLinkageAttribute2(lcName, lcTag) { 1080 if (!SAFE_FOR_XML) { 1081 return false; 1082 } 1083 if (lcName === "patchsrc") { 1084 return true; 1085 } 1086 return lcName === "for" && lcTag !== "label" && lcTag !== "output"; 1087 }; 1088 const _neutralizePatchLinkage = function _neutralizePatchLinkage2(root) { 1089 if (!SAFE_FOR_XML) { 1090 return; 1091 } 1092 const stack = [root]; 1093 while (stack.length > 0) { 1094 const node = stack.pop(); 1095 const nodeType = _readNodeType(node); 1096 if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) { 1097 try { 1098 remove(node); 1099 } catch (_) { 1100 } 1101 continue; 1102 } 1103 if (nodeType === NODE_TYPE.element) { 1104 const element = node; 1105 const lcTag = transformCaseFunc(_readNodeName(node)); 1106 try { 1107 if (element.hasAttribute && element.hasAttribute("patchsrc")) { 1108 element.removeAttribute("patchsrc"); 1109 } 1110 if (element.hasAttribute && element.hasAttribute("for") && _isPatchLinkageAttribute("for", lcTag)) { 1111 element.removeAttribute("for"); 1112 } 1113 } catch (_) { 1114 } 1115 } 1116 const childNodes = getChildNodes(node); 1117 if (childNodes) { 1118 for (let i = childNodes.length - 1; i >= 0; --i) { 1119 stack.push(childNodes[i]); 1120 } 1121 } 1122 } 1123 }; 1124 const _initDocument = function _initDocument2(dirty) { 1125 let doc = null; 1126 let leadingWhitespace = null; 1127 if (FORCE_BODY) { 1128 dirty = "<remove></remove>" + dirty; 1129 } else { 1130 const matches = stringMatch(dirty, /^[\r\n\t ]+/); 1131 leadingWhitespace = matches && matches[0]; 1132 } 1133 if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) { 1134 dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>"; 1135 } 1136 const dirtyPayload = trustedTypesPolicy ? _createTrustedHTML(dirty) : dirty; 1137 if (NAMESPACE === HTML_NAMESPACE) { 1138 try { 1139 doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE); 1140 } catch (_) { 1141 } 1142 } 1143 if (!doc || !doc.documentElement) { 1144 doc = implementation.createDocument(NAMESPACE, "template", null); 1145 try { 1146 doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload; 1147 } catch (_) { 1148 } 1149 } 1150 const body = doc.body || doc.documentElement; 1151 if (dirty && leadingWhitespace) { 1152 body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null); 1153 } 1154 if (NAMESPACE === HTML_NAMESPACE) { 1155 return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0]; 1156 } 1157 return WHOLE_DOCUMENT ? doc.documentElement : body; 1158 }; 1159 const _createNodeIterator = function _createNodeIterator2(root) { 1160 const doc = getOwnerDocument ? getOwnerDocument(root) : root.ownerDocument; 1161 return createNodeIterator.call( 1162 doc || root, 1163 root, 1164 // eslint-disable-next-line no-bitwise 1165 NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, 1166 null 1167 ); 1168 }; 1169 const _stripTemplateExpressions = function _stripTemplateExpressions2(value) { 1170 value = stringReplace(value, MUSTACHE_EXPR$1, " "); 1171 value = stringReplace(value, ERB_EXPR$1, " "); 1172 value = stringReplace(value, TMPLIT_EXPR$1, " "); 1173 return value; 1174 }; 1175 const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) { 1176 var _node$querySelectorAl; 1177 node.normalize(); 1178 const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument; 1179 const walker = createNodeIterator.call( 1180 doc || node, 1181 node, 1182 // eslint-disable-next-line no-bitwise 1183 NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, 1184 null 1185 ); 1186 let currentNode = walker.nextNode(); 1187 while (currentNode) { 1188 currentNode.data = _stripTemplateExpressions(currentNode.data); 1189 currentNode = walker.nextNode(); 1190 } 1191 const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template"); 1192 if (templates) { 1193 arrayForEach(templates, (tmpl) => { 1194 if (_isDocumentFragment(tmpl.content)) { 1195 _scrubTemplateExpressions2(tmpl.content); 1196 } 1197 }); 1198 } 1199 }; 1200 const _isClobbered = function _isClobbered2(element) { 1201 const realTagName = getNodeName ? getNodeName(element) : null; 1202 if (typeof realTagName !== "string") { 1203 return false; 1204 } 1205 if (transformCaseFunc(realTagName) !== "form") { 1206 return false; 1207 } 1208 return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || // Realm-safe NamedNodeMap detection: equality against the cached 1209 // prototype getter. Clobbered .attributes (e.g. <input name="attributes">) 1210 // makes the direct read diverge from the cached read; a clean form 1211 // (same-realm OR foreign-realm) has both reads pointing at the same 1212 // canonical NamedNodeMap. 1213 element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || // NodeType clobbering probe. Cached Node.prototype.nodeType getter 1214 // returns the integer 1 for any Element regardless of realm; direct 1215 // read on a clobbered form (e.g. <input name="nodeType">) returns 1216 // the named child element. Cheap addition â nodeType is read from 1217 // an internal slot, no serialization cost â and removes a residual 1218 // clobbering surface used by several mXSS / PI / comment branches 1219 // in _sanitizeElements that compare currentNode.nodeType directly. 1220 element.nodeType !== getNodeType(element) || // HTMLFormElement has [LegacyOverrideBuiltIns]: a descendant named 1221 // "childNodes" shadows the prototype getter. Direct reads of 1222 // form.childNodes from a clobbered form return the named child 1223 // instead of the real NodeList, so any walk that reads it directly 1224 // skips the form's real children. Compare the direct read to the 1225 // cached Node.prototype getter â when the form's named-property 1226 // getter intercepts the read, the two values differ and we flag 1227 // the form. This catches every clobbering child type (input, 1228 // select, etc.) regardless of whether the named child happens to 1229 // carry a numeric .length, which a typeof-based probe would miss 1230 // (e.g. HTMLSelectElement.length is a defined unsigned-long). 1231 element.childNodes !== getChildNodes(element); 1232 }; 1233 const _isDocumentFragment = function _isDocumentFragment2(value) { 1234 if (!getNodeType || typeof value !== "object" || value === null) { 1235 return false; 1236 } 1237 try { 1238 return getNodeType(value) === NODE_TYPE.documentFragment; 1239 } catch (_) { 1240 return false; 1241 } 1242 }; 1243 const _isNode = function _isNode2(value) { 1244 if (!getNodeType || typeof value !== "object" || value === null) { 1245 return false; 1246 } 1247 try { 1248 return typeof getNodeType(value) === "number"; 1249 } catch (_) { 1250 return false; 1251 } 1252 }; 1253 function _executeHooks(hooks2, currentNode, data) { 1254 if (hooks2.length === 0) { 1255 return; 1256 } 1257 arrayForEach(hooks2, (hook) => { 1258 hook.call(DOMPurify, currentNode, data, CONFIG); 1259 }); 1260 } 1261 const _isUnsafeNode = function _isUnsafeNode2(currentNode, tagName) { 1262 if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) { 1263 return true; 1264 } 1265 if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && LITERAL_TEXT_ELEMENTS[tagName] && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(LITERAL_TEXT_CLOSE[tagName], currentNode.textContent))) { 1266 return true; 1267 } 1268 if (currentNode.nodeType === NODE_TYPE.processingInstruction) { 1269 return true; 1270 } 1271 if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) { 1272 return true; 1273 } 1274 return false; 1275 }; 1276 const _matchesNameCheck = function _matchesNameCheck2(check, name) { 1277 if (check instanceof RegExp) { 1278 return regExpTest(check, name); 1279 } 1280 if (check instanceof Function) { 1281 for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) { 1282 args[_key - 2] = arguments[_key]; 1283 } 1284 return Boolean(check(name, ...args)); 1285 } 1286 return false; 1287 }; 1288 const _sanitizeDisallowedNode = function _sanitizeDisallowedNode2(currentNode, tagName, root) { 1289 if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) { 1290 return false; 1291 } 1292 if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) { 1293 const parentNode = getParentNode(currentNode); 1294 const childNodes = getChildNodes(currentNode); 1295 if (childNodes && parentNode) { 1296 const childCount = childNodes.length; 1297 for (let i = childCount - 1; i >= 0; --i) { 1298 const hoisted = currentNode === root ? cloneNode(childNodes[i], true) : childNodes[i]; 1299 parentNode.insertBefore(hoisted, getNextSibling(currentNode)); 1300 } 1301 } 1302 } 1303 _forceRemove(currentNode); 1304 return true; 1305 }; 1306 const _forkSharedAllowlist = function _forkSharedAllowlist2(hookList, set, defaultSet, setConfigSet) { 1307 if (hookList.length === 0) { 1308 return set; 1309 } 1310 return set === defaultSet || set === setConfigSet ? clone(set) : set; 1311 }; 1312 const _handleHookDetachedNode = function _handleHookDetachedNode2(currentNode, root) { 1313 if (currentNode === root || getParentNode(currentNode) !== null) { 1314 return false; 1315 } 1316 if (IN_PLACE) { 1317 _neutralizeSubtree(currentNode); 1318 } 1319 return true; 1320 }; 1321 const _sanitizeElements = function _sanitizeElements2(currentNode, root) { 1322 _executeHooks(hooks.beforeSanitizeElements, currentNode, null); 1323 if (_handleHookDetachedNode(currentNode, root)) { 1324 return true; 1325 } 1326 if (_isClobbered(currentNode)) { 1327 _forceRemove(currentNode); 1328 return true; 1329 } 1330 const tagName = transformCaseFunc(_readNodeName(currentNode)); 1331 ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS); 1332 _executeHooks(hooks.uponSanitizeElement, currentNode, { 1333 tagName, 1334 allowedTags: ALLOWED_TAGS 1335 }); 1336 if (_handleHookDetachedNode(currentNode, root)) { 1337 return true; 1338 } 1339 if (_isUnsafeNode(currentNode, tagName)) { 1340 _forceRemove(currentNode); 1341 return true; 1342 } 1343 if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) { 1344 const removed = _sanitizeDisallowedNode(currentNode, tagName, root); 1345 if (removed === false) { 1346 _executeHooks(hooks.afterSanitizeElements, currentNode, null); 1347 } 1348 return removed; 1349 } 1350 const nt = _readNodeType(currentNode); 1351 if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) { 1352 _forceRemove(currentNode); 1353 return true; 1354 } 1355 if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) { 1356 _forceRemove(currentNode); 1357 return true; 1358 } 1359 if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { 1360 const content = _stripTemplateExpressions(currentNode.textContent); 1361 if (currentNode.textContent !== content) { 1362 arrayPush(DOMPurify.removed, { 1363 element: currentNode.cloneNode() 1364 }); 1365 currentNode.textContent = content; 1366 } 1367 } 1368 _executeHooks(hooks.afterSanitizeElements, currentNode, null); 1369 return false; 1370 }; 1371 const _isValidAttribute = function _isValidAttribute2(lcTag, lcName, value) { 1372 if (FORBID_ATTR[lcName]) { 1373 return false; 1374 } 1375 if (_isPatchLinkageAttribute(lcName, lcTag)) { 1376 return false; 1377 } 1378 if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) { 1379 return false; 1380 } 1381 const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag); 1382 if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) { 1383 return true; 1384 } 1385 if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) { 1386 return true; 1387 } 1388 if (!nameIsPermitted) { 1389 return ( 1390 // Condition a) covers a basically valid custom element tag name whose 1391 // tag passes the configured tagNameCheck and whose attribute name 1392 // passes the configured attributeNameCheck ... 1393 _isBasicCustomElement(lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName, lcTag) || // Condition b) covers an `is` attribute whose value passes the 1394 // configured tagNameCheck while customized built-in elements are 1395 // allowed. 1396 lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) 1397 ); 1398 } 1399 if (URI_SAFE_ATTRIBUTES[lcName]) { 1400 return true; 1401 } 1402 if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) { 1403 return true; 1404 } 1405 if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) { 1406 return true; 1407 } 1408 if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) { 1409 return true; 1410 } 1411 return !value; 1412 }; 1413 const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, ["annotation-xml", "color-profile", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "missing-glyph"]); 1414 const _isBasicCustomElement = function _isBasicCustomElement2(tagName) { 1415 return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName); 1416 }; 1417 const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute2(lcTag, lcName, namespaceURI, value) { 1418 if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function" && !namespaceURI) { 1419 switch (trustedTypes.getAttributeType(lcTag, lcName)) { 1420 case "TrustedHTML": { 1421 return _createTrustedHTML(value); 1422 } 1423 case "TrustedScriptURL": { 1424 return _createTrustedScriptURL(value); 1425 } 1426 } 1427 } 1428 return value; 1429 }; 1430 const _setAttributeValue = function _setAttributeValue2(currentNode, name, namespaceURI, value) { 1431 try { 1432 if (namespaceURI) { 1433 currentNode.setAttributeNS(namespaceURI, name, value); 1434 } else { 1435 currentNode.setAttribute(name, value); 1436 } 1437 if (_isClobbered(currentNode)) { 1438 _forceRemove(currentNode); 1439 } else { 1440 arrayPop(DOMPurify.removed); 1441 } 1442 } catch (_) { 1443 _removeAttribute(name, currentNode); 1444 } 1445 }; 1446 const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) { 1447 _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null); 1448 const attributes = currentNode.attributes; 1449 if (!attributes || _isClobbered(currentNode)) { 1450 return; 1451 } 1452 ALLOWED_ATTR = _forkSharedAllowlist(hooks.uponSanitizeAttribute, ALLOWED_ATTR, DEFAULT_ALLOWED_ATTR, SET_CONFIG_ALLOWED_ATTR); 1453 const hookEvent = { 1454 attrName: "", 1455 attrValue: "", 1456 keepAttr: true, 1457 allowedAttributes: ALLOWED_ATTR, 1458 forceKeepAttr: void 0 1459 }; 1460 let l = attributes.length; 1461 const lcTag = transformCaseFunc(currentNode.nodeName); 1462 while (l--) { 1463 const attr = attributes[l]; 1464 const name = attr.name, namespaceURI = attr.namespaceURI, attrValue = attr.value; 1465 const lcName = transformCaseFunc(name); 1466 const initValue = attrValue; 1467 let value = name === "value" ? initValue : stringTrim(initValue); 1468 hookEvent.attrName = lcName; 1469 hookEvent.attrValue = value; 1470 hookEvent.keepAttr = true; 1471 hookEvent.forceKeepAttr = void 0; 1472 _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent); 1473 value = hookEvent.attrValue; 1474 if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) { 1475 _removeAttribute(name, currentNode, attr); 1476 value = SANITIZE_NAMED_PROPS_PREFIX + value; 1477 } 1478 if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) { 1479 _removeAttribute(name, currentNode, attr); 1480 continue; 1481 } 1482 if (lcName === "attributename" && stringMatch(value, "href")) { 1483 _removeAttribute(name, currentNode, attr); 1484 continue; 1485 } 1486 if (hookEvent.forceKeepAttr) { 1487 continue; 1488 } 1489 if (!hookEvent.keepAttr) { 1490 _removeAttribute(name, currentNode, attr); 1491 continue; 1492 } 1493 if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) { 1494 _removeAttribute(name, currentNode, attr); 1495 continue; 1496 } 1497 if (SAFE_FOR_TEMPLATES) { 1498 value = _stripTemplateExpressions(value); 1499 } 1500 if (!_isValidAttribute(lcTag, lcName, value)) { 1501 _removeAttribute(name, currentNode, attr); 1502 continue; 1503 } 1504 value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value); 1505 if (value !== initValue) { 1506 _setAttributeValue(currentNode, name, namespaceURI, value); 1507 } 1508 } 1509 _executeHooks(hooks.afterSanitizeAttributes, currentNode, null); 1510 }; 1511 const _sanitizeShadowDOM2 = function _sanitizeShadowDOM(fragment) { 1512 let shadowNode = null; 1513 const shadowIterator = _createNodeIterator(fragment); 1514 _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null); 1515 while (shadowNode = shadowIterator.nextNode()) { 1516 _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null); 1517 _sanitizeElements(shadowNode, fragment); 1518 _sanitizeAttributes(shadowNode); 1519 if (_isDocumentFragment(shadowNode.content)) { 1520 _sanitizeShadowDOM2(shadowNode.content); 1521 } 1522 if (_readNodeType(shadowNode) === NODE_TYPE.element) { 1523 const innerSr = getShadowRoot(shadowNode); 1524 if (_isDocumentFragment(innerSr)) { 1525 _sanitizeAttachedShadowRoots(innerSr); 1526 _sanitizeShadowDOM2(innerSr); 1527 } 1528 } 1529 } 1530 _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null); 1531 }; 1532 const _sanitizeAttachedShadowRoots = function _sanitizeAttachedShadowRoots2(root) { 1533 const stack = [{ 1534 node: root, 1535 shadow: null 1536 }]; 1537 while (stack.length > 0) { 1538 const item = stack.pop(); 1539 if (item.shadow) { 1540 _sanitizeShadowDOM2(item.shadow); 1541 continue; 1542 } 1543 const node = item.node; 1544 const nodeType = _readNodeType(node); 1545 const isElement = nodeType === NODE_TYPE.element; 1546 const childNodes = getChildNodes(node); 1547 if (childNodes) { 1548 for (let i = childNodes.length - 1; i >= 0; --i) { 1549 stack.push({ 1550 node: childNodes[i], 1551 shadow: null 1552 }); 1553 } 1554 } 1555 if (isElement) { 1556 const rootName = getNodeName ? getNodeName(node) : null; 1557 if (typeof rootName === "string" && transformCaseFunc(rootName) === "template") { 1558 const content = node.content; 1559 if (_isDocumentFragment(content)) { 1560 stack.push({ 1561 node: content, 1562 shadow: null 1563 }); 1564 } 1565 } 1566 } 1567 if (isElement) { 1568 const sr = getShadowRoot(node); 1569 if (_isDocumentFragment(sr)) { 1570 stack.push({ 1571 node: null, 1572 shadow: sr 1573 }, { 1574 node: sr, 1575 shadow: null 1576 }); 1577 } 1578 } 1579 } 1580 }; 1581 DOMPurify.sanitize = function(dirty) { 1582 let cfg = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {}; 1583 let body = null; 1584 let importedNode = null; 1585 let currentNode = null; 1586 let returnNode = null; 1587 IS_EMPTY_INPUT = !dirty; 1588 if (IS_EMPTY_INPUT) { 1589 dirty = "<!-->"; 1590 } 1591 if (typeof dirty !== "string" && !_isNode(dirty)) { 1592 dirty = stringifyValue(dirty); 1593 if (typeof dirty !== "string") { 1594 throw typeErrorCreate("dirty is not a string, aborting"); 1595 } 1596 } 1597 if (!DOMPurify.isSupported) { 1598 return dirty; 1599 } 1600 if (SET_CONFIG) { 1601 ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS; 1602 ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR; 1603 } else { 1604 _parseConfig(cfg); 1605 } 1606 if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) { 1607 ALLOWED_TAGS = clone(ALLOWED_TAGS); 1608 } 1609 if (hooks.uponSanitizeAttribute.length > 0) { 1610 ALLOWED_ATTR = clone(ALLOWED_ATTR); 1611 } 1612 DOMPurify.removed = []; 1613 const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty); 1614 if (inPlace) { 1615 _neutralizePatchLinkage(dirty); 1616 const nn = _readNodeName(dirty); 1617 if (typeof nn === "string") { 1618 const tagName = transformCaseFunc(nn); 1619 if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) { 1620 _neutralizeRoot(dirty); 1621 throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place"); 1622 } 1623 } 1624 if (_isClobbered(dirty)) { 1625 _neutralizeRoot(dirty); 1626 throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place"); 1627 } 1628 try { 1629 _sanitizeAttachedShadowRoots(dirty); 1630 } catch (error) { 1631 _neutralizeRoot(dirty); 1632 throw error; 1633 } 1634 } else if (_isNode(dirty)) { 1635 body = _initDocument("<!---->"); 1636 importedNode = body.ownerDocument.importNode(dirty, true); 1637 if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") { 1638 body = importedNode; 1639 } else if (importedNode.nodeName === "HTML") { 1640 body = importedNode; 1641 } else { 1642 body.appendChild(importedNode); 1643 } 1644 _sanitizeAttachedShadowRoots(importedNode); 1645 } else { 1646 if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes 1647 dirty.indexOf("<") === -1) { 1648 return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty; 1649 } 1650 body = _initDocument(dirty); 1651 if (!body) { 1652 return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : ""; 1653 } 1654 } 1655 if (body && FORCE_BODY) { 1656 _forceRemove(body.firstChild); 1657 } 1658 const walkRoot = inPlace ? dirty : body; 1659 try { 1660 const nodeIterator = _createNodeIterator(walkRoot); 1661 while (currentNode = nodeIterator.nextNode()) { 1662 _sanitizeElements(currentNode, walkRoot); 1663 _sanitizeAttributes(currentNode); 1664 if (_isDocumentFragment(currentNode.content)) { 1665 _sanitizeShadowDOM2(currentNode.content); 1666 } 1667 } 1668 } catch (error) { 1669 if (inPlace) { 1670 _neutralizeRoot(dirty); 1671 arrayForEach(DOMPurify.removed, (entry) => { 1672 if (entry.element) { 1673 _neutralizeSubtree(entry.element); 1674 } 1675 }); 1676 } 1677 throw error; 1678 } 1679 if (inPlace) { 1680 arrayForEach(DOMPurify.removed, (entry) => { 1681 if (entry.element) { 1682 _neutralizeSubtree(entry.element); 1683 } 1684 }); 1685 if (SAFE_FOR_TEMPLATES) { 1686 _scrubTemplateExpressions2(dirty); 1687 } 1688 return dirty; 1689 } 1690 if (RETURN_DOM) { 1691 if (SAFE_FOR_TEMPLATES) { 1692 _scrubTemplateExpressions2(body); 1693 } 1694 if (RETURN_DOM_FRAGMENT) { 1695 returnNode = createDocumentFragment.call(body.ownerDocument); 1696 while (body.firstChild) { 1697 returnNode.appendChild(body.firstChild); 1698 } 1699 } else { 1700 returnNode = body; 1701 } 1702 if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) { 1703 returnNode = importNode.call(originalDocument, returnNode, true); 1704 } 1705 return returnNode; 1706 } 1707 let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML; 1708 if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) { 1709 serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML; 1710 } 1711 if (SAFE_FOR_TEMPLATES) { 1712 serializedHTML = _stripTemplateExpressions(serializedHTML); 1713 } 1714 return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML; 1715 }; 1716 DOMPurify.setConfig = function() {
1717 let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {}; 1718 _parseConfig(cfg); 1719 SET_CONFIG = true; 1720 SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS; 1721 SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR; 1722 }; 1723 DOMPurify.clearConfig = function() { 1724 CONFIG = null; 1725 SET_CONFIG = false; 1726 SET_CONFIG_ALLOWED_TAGS = null; 1727 SET_CONFIG_ALLOWED_ATTR = null; 1728 trustedTypesPolicy = defaultTrustedTypesPolicy; 1729 emptyHTML = ""; 1730 }; 1731 DOMPurify.isValidAttribute = function(tag, attr, value) { 1732 if (!CONFIG) { 1733 _parseConfig({}); 1734 } 1735 const lcTag = transformCaseFunc(tag); 1736 const lcName = transformCaseFunc(attr); 1737 return _isValidAttribute(lcTag, lcName, value); 1738 }; 1739 DOMPurify.addHook = function(entryPoint, hookFunction) { 1740 if (typeof hookFunction !== "function") { 1741 return; 1742 } 1743 if (!objectHasOwnProperty(hooks, entryPoint)) { 1744 return; 1745 } 1746 arrayPush(hooks[entryPoint], hookFunction); 1747 }; 1748 DOMPurify.removeHook = function(entryPoint, hookFunction) { 1749 if (!objectHasOwnProperty(hooks, entryPoint)) { 1750 return void 0; 1751 } 1752 if (hookFunction !== void 0) { 1753 const index = arrayLastIndexOf(hooks[entryPoint], hookFunction); 1754 return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0]; 1755 } 1756 return arrayPop(hooks[entryPoint]); 1757 }; 1758 DOMPurify.removeHooks = function(entryPoint) { 1759 if (!objectHasOwnProperty(hooks, entryPoint)) { 1760 return; 1761 } 1762 hooks[entryPoint] = []; 1763 }; 1764 DOMPurify.removeAllHooks = function() { 1765 hooks = _createHooksMap(); 1766 }; 1767 return DOMPurify; 1768} 1769var purify = createDOMPurify(); 1770object({ 1771 textAlign: string().optional(), 1772 mobileTextAlign: string().optional() 1773}); 1774const ALLOWED_TEXT_ALIGN = /* @__PURE__ */ new Set(["left", "center", "right"]); 1775function normalizeAlign(value) { 1776 return value && ALLOWED_TEXT_ALIGN.has(value) ? value : void 0; 1777} 1778function legacyTextAlign(props) { 1779 const desktop = normalizeAlign(props.textAlign); 1780 const mobile = normalizeAlign(props.mobileTextAlign) ?? desktop; 1781 if (!mobile) { 1782 return { dataAttr: void 0, style: {} }; 1783 } 1784 const style = { 1785 "--ws-section-text-align-mobile": mobile 1786 }; 1787 if (desktop) { 1788 style["--ws-section-text-align"] = desktop; 1789 } 1790 return { dataAttr: desktop ?? mobile, style }; 1791} 1792function legacyTextAlignCss(rootClass, { headlineOnly = false } = {}) { 1793 const root = `.${rootClass}[data-ws-text-align]`; 1794 const bodyDesktop = headlineOnly ? "" : `${root} { 1795 text-align: var(--ws-section-text-align, inherit); 1796} 1797`; 1798 const bodyMobile = headlineOnly ? "" : ` ${root} { 1799 text-align: var(--ws-section-text-align-mobile, inherit); 1800 } 1801`; 1802 return ` 1803${bodyDesktop}${root} .headline .first-line, 1804${root} .headline .second-line { 1805 text-align: var(--ws-section-text-align, var(--headline-text-align)); 1806} 1807@media screen and (max-width: 767px) { 1808${bodyMobile} ${root} .headline .first-line, 1809 ${root} .headline .second-line { 1810 text-align: var(--ws-section-text-align-mobile, var(--headline-textMobileAlign)); 1811 } 1812} 1813`; 1814} 1815export { 1816 DirectPurchaseEmbed as D, 1817 legacyTextAlign as a, 1818 legacyTextAlignCss as l, 1819 purify as p 1820}; 1821//# sourceMappingURL=legacyTextAlign.mjs.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.